A typical setup has a location block that sends .php requests to PHP-FPM over FastCGI. nginx does not read .htaccess, and it does not read .user.ini either, since PHP-FPM does that. PHP settings can be passed from nginx with fastcgi_param PHP_VALUE and PHP_ADMIN_VALUE.
The catch is that updating nginx does not patch PHP. The fix lives in the PHP-FPM package, and the web server only offers a place to add edge rules. Those rules have to cover every server block that reaches PHP, including default and catch-all servers, or the request arrives by another door.
In October 2026, Mattias Geniar tested an nginx 1.29.8 rule built on a map of the Content-Type header that returns 403 for multipart requests, plus a variant that allows multipart only on named upload endpoints. He added that if an error_page for 403 sends the request back to PHP, return 444 should be used instead. Abstract Security suggested searching nginx and Apache error logs for PHP fatal errors that end in in Unknown on line 0.
Patch PHP-FPM and restart it, add the multipart block to every server block that serves PHP if your applications do not take uploads, and move per-request PHP_VALUE settings into the pool.